[dependabot]

Bumps github.com/fluxcd/image-reflector-controller/api from 1.2.5 to 1.3.0.

Release notes

Sourced from github.com/fluxcd/image-reflector-controller/api's releases.

v1.3.0

Changelog

v1.3.0 changelog

Container images

• docker.io/fluxcd/image-reflector-controller:v1.3.0
• ghcr.io/fluxcd/image-reflector-controller:v1.3.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/image-reflector-controller/api's changelog.

1.3.0

Release date: 2026-10-24

This minor release graduates object-level workload identity, now renamed to object identity, enables the Flux artifact storage backend by default, and introduces SPIFFE mTLS between the controllers.

Object Identity

Object-level workload identity is now generally available and renamed to object identity. Workload identity refers exclusively to identities assigned to Flux controllers, while object identity refers to identities assigned to Flux objects. The ObjectLevelWorkloadIdentity feature gate is retired and the feature is always enabled.

⚠️ Breaking change: the default Flux RBAC no longer grants the create verb on the serviceaccounts/token resource. If your installation relies on the default RBAC, bind a ClusterRole with this permission to the controller ServiceAccount before upgrading. See fluxcd/flux2#6139 for the required ClusterRole and ClusterRoleBinding, and the object identity documentation for the API reference.

Two credential providers can now supply the credential: kubernetes, which uses the Kubernetes TokenRequest API and was already available, and spiffe, which fetches a JWT-SVID from the SPIFFE Broker API. The provider is configured on the ServiceAccount with credential.auth.fluxcd.io/provider, independently of the service provider in .spec.provider.

Inter-Controller mTLS

This release introduces SPIFFE mTLS for inter-controller communication. Flux controllers authenticate each other with X.509-SVIDs, and each traffic type is enabled independently by configuring the SPIFFE Workload API socket and the SPIFFE IDs that the controller authorizes. See the inter-controller mTLS documentation for the controller flags and an example configuration.

ImageRepository

The generic provider now supports object identity. The credential is sent as a bearer token, or as the password in HTTP basic authentication when credential.auth.fluxcd.io/username is set. Audiences default to the registry host and can be overridden with credential.auth.fluxcd.io/audiences.

The Flux artifact storage backend (fluxcd/pkg/artifact/storage) is now the default for the image tag database, replacing BadgerDB. Tags are stored in the same artifact storage used by the other Flux controllers, and the tag file is

... (truncated)

Commits

• 014ee11 Merge pull request #957 from fluxcd/release-v1.3.0
• c13f229 Release v1.3.0
• 849b54a Add changelog entry for v1.3.0
• 4855bb1 Merge pull request #956 from fluxcd/fix-cosign-v3-signing
• 8baeb4b Bump gha-workflows to v0.17.0
• 3bc7b87 Fix goreleaser signing with cosign v3 bundles
• a956675 Merge pull request #954 from fluxcd/rfc-0014-object-identity
• 98288b5 Remove Go report card badge
• 8902d61 [RFC-0014] Rename object-level workload identity to object identity
• 711a1e5 Merge pull request #952 from fluxcd/update-deps-2.10
• Additional commits viewable in compare view

[bigkevmcd]

@dependabot rebase